intlify @intlify/shared vulnerabilities

Latest intlify @intlify/shared CVEs

Newest publication first

1. CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

   Published 2026-10-28

   High·CVSS 7.2

   Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode th...

2. CVE-2024-52810 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

   Published 2024-11-29

   Medium·CVSS 6.9

   @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify proper...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.